jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

OpenSSL: Write PKCS#12 extra cert errors into debug log

Browse source 
Commit de2a7b796d ('OpenSSL: Use
connection certificate chain with PKCS#12 extra certs') added a new
mechanism for doing this with OpenSSL 1.0.2 and newer. However, it did
not poinr out anything in debug log if SSL_add1_chain_cert() failed. Add
such a debug print and also silence static analyzer warning on res being
stored without being read (since the error case is ignored at least for
now).

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-08-24 19:36:34 +03:00
parent c5e44b5917
commit 20f331b707
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/crypto/tls_openssl.c
View file

@ -2237,10 +2237,15 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
wpa_printf(MSG_DEBUG, "TLS: additional certificate" wpa_printf(MSG_DEBUG, "TLS: additional certificate"
" from PKCS12: subject='%s'", buf); " from PKCS12: subject='%s'", buf);
if (SSL_add1_chain_cert(ssl, cert) != 1) { if (SSL_add1_chain_cert(ssl, cert) != 1) {
tls_show_errors(MSG_DEBUG, __func__,
"Failed to add additional certificate");
res = -1; res = -1;
break; break;
} }
} }
if (!res) {
/* Try to continue anyway */
}
sk_X509_free(certs); sk_X509_free(certs);
#ifndef OPENSSL_IS_BORINGSSL #ifndef OPENSSL_IS_BORINGSSL
res = SSL_build_cert_chain(ssl, res = SSL_build_cert_chain(ssl,